Fix ./makedist wrt. to GH move

We can no longer export from git.php.net, and apparently exporting from Github is not supported. We apply a quick fix to export from the local clone by default, still leaving an option to export from some other repo. This is, unfortunately, a minor BC break in a security release. Co-authored-by: Remi Collet <remi@php.net> Closes GH-6919. (cherry picked from commit 096f148c61)
Prepare for 7.3.28
2026-11-11 11:10:49 +00:00 · 2021-04-27 15:53:53 +02:00 · 2021-04-27 11:21:06 +02:00 · 2021-04-26 21:43:03 -07:00 · 2021-04-26 21:01:25 -07:00 · 2021-04-26 20:43:45 -07:00
244 changed files with 24658 additions and 25025 deletions
@@ -1,6 +1,238 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.20
+?? ??? ????, PHP 7.3.29
+
+29 Apr 2021, PHP 7.3.28
+
+- Imap:
+  . Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)
+
+04 Feb 2021, PHP 7.3.27
+
+- SOAP:
+  . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
+
+07 Jan 2021, PHP 7.3.26
+
+- Standard:
+  . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). 
+    (CVE-2020-7071) (cmb)
+  . Fixed bug #80457 (stream_get_contents() fails with maxlength=-1 or default).
+    (bruno dot premont at restena dot lu)
+
+26 Nov 2020, PHP 7.3.25
+
+- Core:
+  . Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
+    (cmb)
+  . Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
+    (cmb)
+
+- COM:
+  . Fixed bug #62474 (com_event_sink crashes on certain arguments). (cmb)
+
+- DOM:
+  . Fixed bug #80268 (loadHTML() truncates at NUL bytes). (cmb)
+
+- IMAP:
+  . Fixed bug #64076 (imap_sort() does not return FALSE on failure). (cmb)
+  . Fixed bug #76618 (segfault on imap_reopen). (girgias)
+  . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb)
+  . Fixed minor regression caused by fixing bug #80220. (cmb)
+  . Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
+    (cmb)
+
+- Intl:
+  . Fixed bug #80310 (ext-intl with icu4c 68.1: use of undeclared identifier
+    'TRUE'). (Alexander M. Turek)
+
+- ODBC:
+  . Fixed bug #44618 (Fetching may rely on uninitialized data). (cmb)
+
+- SNMP:
+  . Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
+    (Alexander Bergmann, cmb)
+
+- Standard:
+  . Fixed bug #80266 (parse_url silently drops port number 0). (cmb, Nikita)
+
+29 Oct 2020, PHP 7.3.24
+
+- Core:
+  . Fixed bug #79423 (copy command is limited to size of file it can copy).
+    (cmb)
+
+- Calendar:
+  . Fixed bug #80185 (jdtounix() fails after 2037). (cmb)
+
+- IMAP:
+  . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
+  . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
+  . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
+  . Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
+    (cmb)
+  . Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
+    (cmb)
+  . Fixed bug #80226 (imap_sort() leaks sortpgm memory). (cmb)
+
+- MySQLnd:
+  . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with
+    slashes). (cmb)
+  . Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when
+    compression is enabled). (Nikita)
+
+- ODBC:
+  . Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable). (cmb)
+  . Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
+    (cmb)
+  . Fixed bug #80150 (Failure to fetch error message). (cmb)
+  . Fixed bug #80152 (odbc_execute() moves internal pointer of $params). (cmb)
+  . Fixed bug #46050 (odbc_next_result corrupts prepared resource). (cmb)
+
+- OPcache:
+  . Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data
+    binding). (Nikita)
+
+- PDO_ODBC:
+  . Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer). (cmb)
+
+- Standard:
+  . Fixed bug #80114 (parse_url does not accept URLs with port 0). (cmb, twosee)
+  . Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors). (cmb)
+  . Fixed bug #76735 (Incorrect message in fopen on invalid mode). (cmb)
+
+- Tidy:
+  . Fixed bug #77040 (tidyNode::isHtml() is completely broken). (cmb)
+
+01 Oct 2020, PHP 7.3.23
+
+- Core:
+  . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb)
+  . Fixed bug #80049 (Memleak when coercing integers to string via variadic
+    argument). (Nikita)
+  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` 
+    cookies can be sent). (CVE-2020-7070) (Stas)
+
+- Calendar:
+  . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
+    (Andy Postnikov)
+
+- COM:
+  . Fixed bug #64130 (COM obj parameters passed by reference are not updated).
+    (cmb)
+
+- OPcache:
+  . Fixed bug #80002 (calc free space for new interned string is wrong).
+    (t-matsuno)
+  . Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode
+    handlers changed). (SammyK)
+
+- OpenSSL:
+  . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 
+    bytes IV). (CVE-2020-7069) (Jakub Zelenka)
+
+- PDO:
+  . Fixed bug #80027 (Terrible performance using $query->fetch on queries with
+    many bind parameters). (Matteo)
+
+- SOAP:
+  . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with
+    "Transfer-Encoding: chunked"). (Matteo)
+
+- Standard:
+  . Fixed bug #79986 (str_ireplace bug with diacritics characters). (cmb)
+  . Fixed bug #80077 (getmxrr test bug). (Rainer Jung)
+  . Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
+    (cmb)
+  . Fixed bug #80067 (Omitting the port in bindto setting errors). (cmb)
+
+03 Sep 2020, PHP 7.3.22
+
+- Core:
+  . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
+  . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
+  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
+  . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
+    (Santiago M. Mola)
+  . Fixed bug #79919 (Stack use-after-scope in define()). (cmb)
+  . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
+    (Pieter van den Ham)
+
+- COM:
+  . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
+    (cmb)
+
+- Exif:
+  . Fixed bug #75785 (Many errors from exif_read_data).
+    (Níckolas Daniel da Silva)
+
+- Gettext:
+  . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
+    gettext()). (Florian Engelhardt)
+
+- LDAP:
+  . Fixed memory leaks. (ptomulik)
+
+- OPcache:
+  . Fixed bug #73060 (php failed with error after temp folder cleaned up).
+    (cmb)
+
+- PDO:
+  . Fixed bug #64705 (errorInfo property of PDOException is null when
+    PDO::__construct() fails). (Ahmed Abdou)
+
+- Standard:
+  . Fixed bug #79930 (array_merge_recursive() crashes when called with array
+    with single reference). (Nikita)
+  . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita)
+  . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita)
+
+- XML:
+  . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb)
+
+06 Aug 2020, PHP 7.3.21
+
+- Apache:
+  . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
+    to return usec). (Herbert256)
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+  . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
+    static variable). (Nikita)
+  . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
+    (Nikita)
+
+- COM:
+  . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb)
+  . Fixed bug #63527 (DCOM does not work with Username, Password parameter).
+    (cmb)
+
+- Curl:
+  . Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with
+    declared properties). (Nikita)
+
+- Fileinfo:
+  . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)
+
+- FTP:
+  . Fixed bug #55857 (ftp_size on large files). (cmb)
+
+- Mbstring:
+  . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+- Standard:
+  . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
+  . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita)
+  . Fixed bug #78008 (dns_check_record() always return true on Alpine).
+    (Andy Postnikov)
+
+09 Jul 2020, PHP 7.3.20

 - Core:
  . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)
@@ -151,6 +151,11 @@ Reflection:
  . Reflection export to string now uses `int` and `bool` instead of `integer`
    and `boolean`.

+- SAPI:
+  . Starting with 7.3.23, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 SPL:
  . If an SPL autoloader throws an exception, following autoloaders will not be
    executed. Previously all autoloaders were executed and exceptions were
@@ -116,16 +116,16 @@ int main()
 		double d = (double) LONG_MIN * LONG_MIN + 2e9;

 		if ((long) d == 2e9 && (long) -d == -2e9) {
-			exit(0);
+			return 0;
 		}
 	} else if (sizeof(long) == 8) {
 		double correct = 18e18 - ((double) LONG_MIN * -2); /* Subtract ULONG_MAX + 1 */

 		if ((long) 18e18 == correct) { /* On 64-bit, only check between LONG_MAX and ULONG_MAX */
-			exit(0);
+			return 0;
 		}
 	}
-	exit(1);
+	return 1;
 }
 ]])], [
  AC_DEFINE([ZEND_DVAL_TO_LVAL_CAST_OK], 1, [Define if double cast to long preserves least significant bits])
@@ -249,7 +249,7 @@ int main()
  fprintf(fp, "%d %d\n", ZEND_MM_ALIGNMENT, zeros);
  fclose(fp);

-  exit(0);
+  return 0;
 }
 ]])], [
  LIBZEND_MM_ALIGN=`cat conftest.zend | cut -d ' ' -f 1`
@@ -318,6 +318,7 @@ AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <sys/mman.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <unistd.h>
 #ifndef MAP_ANON
 # ifdef MAP_ANONYMOUS
 #  define MAP_ANON MAP_ANONYMOUS
@@ -63,7 +63,10 @@ dnl Check for broken sprintf()
 dnl
 AC_DEFUN([AC_ZEND_BROKEN_SPRINTF],[
  AC_CACHE_CHECK(whether sprintf is broken, ac_cv_broken_sprintf,[
-    AC_RUN_IFELSE([AC_LANG_SOURCE([[main() {char buf[20];exit(sprintf(buf,"testing 123")!=11); }]])],[
+    AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <stdio.h>
+int main() {char buf[20]; return sprintf(buf,"testing 123")!=11; }
+]])],[
      ac_cv_broken_sprintf=no
    ],[
      ac_cv_broken_sprintf=yes
@@ -0,0 +1,16 @@
+--TEST--
+Array addition should not add INDIRECT elements
+--FILE--
+<?php
+
+$x = 1;
+$ary = ['y' => 1];
+$ary += $GLOBALS;
+var_dump($ary['x']);
+$x = 2;
+var_dump($ary['x']);
+
+?>
+--EXPECT--
+int(1)
+int(1)
@@ -0,0 +1,10 @@
+--TEST--
+Add $GLOBALS to itself
+--FILE--
+<?php
+$GLOBALS += $GLOBALS;
+$x = $GLOBALS + $GLOBALS;
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,13 @@
+--TEST--
+Assign concat of array and empty string
+--FILE--
+<?php
+
+$a = [0];
+$a .= '';
+var_dump($a);
+
+?>
+--EXPECTF--
+Notice: Array to string conversion in %s on line %d
+string(5) "Array"
@@ -26,7 +26,7 @@ namespace N2 {
    echo $a->hello(), PHP_EOL;
    echo $a->foo(), PHP_EOL;
    try {
-    } catch(namespace \Foo $e)
+    } catch(namespace\Foo $e)
    {
    }
 }
@@ -0,0 +1,26 @@
+--TEST--
+Bug #79778: Assertion failure if dumping closure with unresolved static variable
+--FILE--
+<?php
+$closure1 = function() {
+    static $var = CONST_REF;
+};
+var_dump($closure1);
+print_r($closure1);
+?>
+--EXPECT--
+object(Closure)#1 (1) {
+  ["static"]=>
+  array(1) {
+    ["var"]=>
+    string(14) "<constant ast>"
+  }
+}
+Closure Object
+(
+    [static] => Array
+        (
+            [var] => <constant ast>
+        )
+
+)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79792: HT iterators not removed if empty array is destroyed
+--FILE--
+<?php
+$a = [42];
+foreach ($a as &$c) {
+    // Make the array empty.
+    unset($a[0]);
+    // Destroy the array.
+    $a = null;
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79919 (Stack use-after-scope in define())
+--SKIPIF--
+<?php
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+?>
+--FILE--
+<?php
+$b = error_log(0);
+$b = simplexml_load_string('<xml/>', null, $b);
+define(0, $b);
+?>
+--EXPECT--
+0
@@ -0,0 +1,29 @@
+--TEST--
+Bug #79934: CRLF-only line in heredoc causes parsing error
+--DESCRIPTION--
+This test covers different variations of whitespace-only lines in heredoc strings.
+These whitespace-only lines should be ignored when stripping indentation.
+--FILE--
+<?php
+// lines with only CRLF should not cause a parse error
+eval("\$s1 = <<<HEREDOC\r\n    a\r\n\r\n    b\r\n    HEREDOC;");
+var_dump(addcslashes($s1, "\r\n"));
+
+// lines with only a LF should not cause a parse error
+eval("\$s2 = <<<HEREDOC\n    a\n\n    b\n    HEREDOC;");
+var_dump(addcslashes($s2, "\n"));
+
+// lines with only a CR should not cause a parse error
+eval("\$s3 = <<<HEREDOC\r    a\r\r    b\r    HEREDOC;");
+var_dump(addcslashes($s3, "\r"));
+
+// lines with only whitespace should not cause a parse error
+eval("\$s4 = <<<HEREDOC\r    a\r\n  \r\n    b\r    HEREDOC;");
+var_dump(addcslashes($s4, "\n\r"));
+
+?>
+--EXPECT--
+string(10) "a\r\n\r\nb"
+string(6) "a\n\nb"
+string(6) "a\r\rb"
+string(10) "a\r\n\r\nb"
@@ -0,0 +1,14 @@
+--TEST--
+Bug #80049: Memleak when coercing integers to string via variadic argument
+--FILE--
+<?php
+function coerceToString(string ...$strings) {
+    var_dump($strings);
+}
+coerceToString(...[123]);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(3) "123"
+}
@@ -0,0 +1,20 @@
+--TEST--
+Leak when setting recursive previous exception in finally handling
+--FILE--
+<?php
+
+try {
+    try {
+        throw new Exception("Test");
+    } catch (Exception $e) {
+        throw $e;
+    } finally {
+        throw $e;
+    }
+} catch (Exception $e2) {
+    echo $e2->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Test
@@ -0,0 +1,18 @@
+--TEST--
+Yield from non-iterable
+--FILE--
+<?php
+
+function gen() {
+    yield from new stdClass;
+}
+
+try {
+    gen()->current();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Can use "yield from" only with arrays and Traversables
@@ -0,0 +1,30 @@
+--TEST--
+Exception from valid() during yield from
+--FILE--
+<?php
+
+class FooBar implements Iterator {
+    function rewind() {}
+    function current() {}
+    function key() {}
+    function next() {}
+    function valid() {
+        throw new Exception("Exception from valid()");
+    }
+}
+
+function gen() {
+    try {
+        // the fact that the yield from result is used is relevant.
+        var_dump(yield from new FooBar);
+    } catch (Exception $e) {
+        echo $e->getMessage(), "\n";
+    }
+}
+
+$x = gen();
+$x->current();
+
+?>
+--EXPECT--
+Exception from valid()
@@ -0,0 +1,16 @@
+--TEST--
+String offset error during list() by-ref assignment
+--FILE--
+<?php
+
+$a = [0];
+$v = 'b';
+$i = 0;
+list(&$a[$i++]) = $v;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot create references to/from string offsets in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -6,6 +6,7 @@ No warnings should be thrown during heredoc scan-ahead
 <<<TEST
 ${x}
 \400
+${"\400"}
 ${/*}
 TEST;

@@ -15,6 +16,8 @@ Warning: Unexpected character in input:  '' (ASCII=1) state=0 in %s on line %d

 Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d

+Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d
+
 Warning: Unterminated comment starting line %d in %s on line %d

 Parse error: syntax error, unexpected end of file in %s on line %d
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.20-dev"
+#define ZEND_VERSION "3.3.28"

 #define ZEND_ENGINE_3

@@ -4230,7 +4230,7 @@ ZEND_API void zend_save_error_handling(zend_error_handling *current) /* {{{ */
 {
 	current->handling = EG(error_handling);
 	current->exception = EG(exception_class);
-	ZVAL_COPY(&current->user_handler, &EG(user_error_handler));
+	ZVAL_UNDEF(&current->user_handler);
 }
 /* }}} */

@@ -4238,54 +4238,17 @@ ZEND_API void zend_replace_error_handling(zend_error_handling_t error_handling,
 {
 	if (current) {
 		zend_save_error_handling(current);
-		if (error_handling != EH_NORMAL && Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
-			zval_ptr_dtor(&EG(user_error_handler));
-			ZVAL_UNDEF(&EG(user_error_handler));
-		}
 	}
+	ZEND_ASSERT(error_handling == EH_THROW || exception_class == NULL);
 	EG(error_handling) = error_handling;
-	EG(exception_class) = error_handling == EH_THROW ? exception_class : NULL;
-}
-/* }}} */
-
-static int same_zval(zval *zv1, zval *zv2)  /* {{{ */
-{
-	if (Z_TYPE_P(zv1) != Z_TYPE_P(zv2)) {
-		return 0;
-	}
-	switch (Z_TYPE_P(zv1)) {
-		case IS_UNDEF:
-		case IS_NULL:
-		case IS_FALSE:
-		case IS_TRUE:
-			return 1;
-		case IS_LONG:
-			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
-		case IS_DOUBLE:
-			return Z_LVAL_P(zv1) == Z_LVAL_P(zv2);
-		case IS_STRING:
-		case IS_ARRAY:
-		case IS_OBJECT:
-		case IS_RESOURCE:
-			return Z_COUNTED_P(zv1) == Z_COUNTED_P(zv2);
-		default:
-			return 0;
-	}
+	EG(exception_class) = exception_class;
 }
 /* }}} */

 ZEND_API void zend_restore_error_handling(zend_error_handling *saved) /* {{{ */
 {
 	EG(error_handling) = saved->handling;
-	EG(exception_class) = saved->handling == EH_THROW ? saved->exception : NULL;
-	if (Z_TYPE(saved->user_handler) != IS_UNDEF
-		&& !same_zval(&saved->user_handler, &EG(user_error_handler))) {
-		zval_ptr_dtor(&EG(user_error_handler));
-		ZVAL_COPY_VALUE(&EG(user_error_handler), &saved->user_handler);
-	} else if (Z_TYPE(saved->user_handler)) {
-		zval_ptr_dtor(&saved->user_handler);
-	}
-	ZVAL_UNDEF(&saved->user_handler);
+	EG(exception_class) = saved->exception;
 }
 /* }}} */

@@ -882,9 +882,7 @@ repeat:
 		case IS_OBJECT:
 			if (Z_TYPE(val_free) == IS_UNDEF) {
 				if (Z_OBJ_HT_P(val)->get) {
-					zval rv;
-					val = Z_OBJ_HT_P(val)->get(val, &rv);
-					ZVAL_COPY_VALUE(&val_free, val);
+					val = Z_OBJ_HT_P(val)->get(val, &val_free);
 					goto repeat;
 				} else if (Z_OBJ_HT_P(val)->cast_object) {
 					if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) {
@@ -506,9 +506,16 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	debug_info = zend_new_array(8);

 	if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
+		zval *var;
 		HashTable *static_variables = closure->func.op_array.static_variables;
 		ZVAL_ARR(&val, zend_array_dup(static_variables));
 		zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
+		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(val), var) {
+			if (Z_TYPE_P(var) == IS_CONSTANT_AST) {
+				zval_ptr_dtor(var);
+				ZVAL_STRING(var, "<constant ast>");
+			}
+		} ZEND_HASH_FOREACH_END();
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -659,6 +666,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 	if (func->type == ZEND_USER_FUNCTION) {
 		memcpy(&closure->func, func, sizeof(zend_op_array));
 		closure->func.common.fn_flags |= ZEND_ACC_CLOSURE;
+		closure->func.common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
 		if (closure->func.op_array.static_variables) {
 			closure->func.op_array.static_variables =
 				zend_array_dup(closure->func.op_array.static_variables);
@@ -669,7 +677,9 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 			|| func->common.scope != scope
 			|| (func->common.fn_flags & ZEND_ACC_NO_RT_ARENA)
 		) {
-			if (!func->op_array.run_time_cache && (func->common.fn_flags & ZEND_ACC_CLOSURE)) {
+			if (!func->op_array.run_time_cache
+			 && (func->common.fn_flags & ZEND_ACC_CLOSURE)
+			 && !(func->common.fn_flags & ZEND_ACC_IMMUTABLE)) {
 				/* If a real closure is used for the first time, we create a shared runtime cache
 				 * and remember which scope it is for. */
 				func->common.scope = scope;
@@ -76,9 +76,15 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 	zval  pv, zv, rv;
 	zend_class_entry *base_ce;

-	if (exception == add_previous || !add_previous || !exception) {
+	if (!exception || !add_previous) {
 		return;
 	}
+
+	if (exception == add_previous) {
+		OBJ_RELEASE(add_previous);
+		return;
+	}
+
 	ZVAL_OBJ(&pv, add_previous);
 	if (!instanceof_function(Z_OBJCE(pv), zend_ce_throwable)) {
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
@@ -1329,6 +1329,7 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
 					msg = "Cannot create references to/from string offsets";
 					break;
 				}
+				opline++;
 			}
 			break;
 		EMPTY_SWITCH_DEFAULT_CASE();
@@ -253,10 +253,6 @@ static void zend_generator_free_storage(zend_object *object) /* {{{ */
 	}

 	zend_object_std_dtor(&generator->std);
-
-	if (generator->iterator) {
-		zend_iterator_dtor(generator->iterator);
-	}
 }
 /* }}} */

@@ -713,6 +709,9 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 		}

 		if (iter->funcs->valid(iter) == FAILURE) {
+			if (UNEXPECTED(EG(exception) != NULL)) {
+				goto exception;
+			}
 			/* reached end of iteration */
 			goto failure;
 		}
@@ -741,7 +740,7 @@ static int zend_generator_get_next_delegated_value(zend_generator *generator) /*
 	return SUCCESS;

 exception:
-	zend_rethrow_exception(generator->execute_data);
+	zend_generator_throw_exception(generator, NULL);

 failure:
 	zval_ptr_dtor(&generator->values);
@@ -1504,11 +1504,11 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 				}
 			} while (++p != end);
 		}
-		zend_hash_iterators_remove(ht);
-		SET_INCONSISTENT(HT_DESTROYED);
 	} else if (EXPECTED(!(HT_FLAGS(ht) & HASH_FLAG_INITIALIZED))) {
 		goto free_ht;
 	}
+	zend_hash_iterators_remove(ht);
+	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
 	FREE_HASHTABLE(ht);
@@ -1999,7 +1999,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 {
    uint32_t idx;
 	Bucket *p;
-	zval *t;
+	zval *t, *s;

 	IS_CONSISTENT(source);
 	IS_CONSISTENT(target);
@@ -2008,18 +2008,20 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	if (overwrite) {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
-			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
-			    continue;
+			s = &p->val;
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
+				s = Z_INDIRECT_P(s);
+			}
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
+				continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_UPDATE | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_UPDATE | HASH_UPDATE_INDIRECT);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_update(target, p->h, &p->val);
+				t = zend_hash_index_update(target, p->h, s);
 				if (pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -2028,18 +2030,20 @@ ZEND_API void ZEND_FASTCALL zend_hash_merge(HashTable *target, HashTable *source
 	} else {
 		for (idx = 0; idx < source->nNumUsed; idx++) {
 			p = source->arData + idx;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_UNDEF)) continue;
-			if (UNEXPECTED(Z_TYPE(p->val) == IS_INDIRECT) &&
-			    UNEXPECTED(Z_TYPE_P(Z_INDIRECT(p->val)) == IS_UNDEF)) {
-			    continue;
+			s = &p->val;
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_INDIRECT)) {
+				s = Z_INDIRECT_P(s);
+			}
+			if (UNEXPECTED(Z_TYPE_P(s) == IS_UNDEF)) {
+				continue;
 			}
 			if (p->key) {
-				t = _zend_hash_add_or_update_i(target, p->key, &p->val, HASH_ADD | HASH_UPDATE_INDIRECT);
+				t = _zend_hash_add_or_update_i(target, p->key, s, HASH_ADD | HASH_UPDATE_INDIRECT);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
 			} else {
-				t = zend_hash_index_add(target, p->h, &p->val);
+				t = zend_hash_index_add(target, p->h, s);
 				if (t && pCopyConstructor) {
 					pCopyConstructor(t);
 				}
@@ -334,7 +334,7 @@ ZEND_API int zend_alter_ini_entry_ex(zend_string *name, zend_string *new_value,
 {
 	zend_ini_entry *ini_entry;
 	zend_string *duplicate;
-	zend_bool modifiable;
+	uint8_t modifiable;
 	zend_bool modified;

 	if ((ini_entry = zend_hash_find_ptr(EG(ini_directives), name)) == NULL) {
@@ -1,4 +1,4 @@
-/* Generated by re2c 1.0.1 */
+/* Generated by re2c 1.3 */
 #line 1 "Zend/zend_language_scanner.l"
 /*
   +----------------------------------------------------------------------+
@@ -1069,8 +1069,7 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								octal_buf[2] = *(++s);
 							}
 						}
-						if (octal_buf[2] &&
-						    (octal_buf[0] > '3')) {
+						if (octal_buf[2] && (octal_buf[0] > '3') && !SCNG(heredoc_scan_ahead)) {
 							/* 3 octit values must not overflow 0xFF (\377) */
 							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
 						}
@@ -1115,6 +1114,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -1066,8 +1066,7 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								octal_buf[2] = *(++s);
 							}
 						}
-						if (octal_buf[2] &&
-						    (octal_buf[0] > '3')) {
+						if (octal_buf[2] && (octal_buf[0] > '3') && !SCNG(heredoc_scan_ahead)) {
 							/* 3 octit values must not overflow 0xFF (\377) */
 							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
 						}
@@ -1112,6 +1111,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -1,5 +1,4 @@
-/* Generated by re2c 1.0.1 */
-#line 3 "Zend/zend_language_scanner_defs.h"
+/* Generated by re2c 1.3 */

 enum YYCONDTYPE {
 	yycST_IN_SCRIPTING,
@@ -903,7 +903,7 @@ try_again:

 static zend_never_inline void ZEND_FASTCALL add_function_array(zval *result, zval *op1, zval *op2) /* {{{ */
 {
-	if ((result == op1) && (result == op2)) {
+	if (result == op1 && Z_ARR_P(op1) == Z_ARR_P(op2)) {
 		/* $a += $a */
 		return;
 	}
@@ -1836,6 +1836,9 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 		}
 	} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {
 		if (EXPECTED(result != op1)) {
+			if (result == orig_op1) {
+				i_zval_ptr_dtor(result ZEND_FILE_LINE_CC);
+			}
 			ZVAL_COPY(result, op1);
 		}
 	} else {
@@ -186,12 +186,13 @@ static zend_always_inline zend_string *zend_string_realloc(zend_string *s, size_
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN(len, ZSTR_LEN(s)) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -206,12 +207,13 @@ static zend_always_inline zend_string *zend_string_extend(zend_string *s, size_t
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), ZSTR_LEN(s) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -226,12 +228,13 @@ static zend_always_inline zend_string *zend_string_truncate(zend_string *s, size
 			ZSTR_LEN(ret) = len;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_alloc(len, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), len + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -245,12 +248,13 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s,
 			ZSTR_LEN(ret) = (n * m) + l;
 			zend_string_forget_hash_val(ret);
 			return ret;
-		} else {
-			GC_DELREF(s);
 		}
 	}
 	ret = zend_string_safe_alloc(n, m, l, persistent);
 	memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN((n * m) + l, ZSTR_LEN(s)) + 1);
+	if (!ZSTR_IS_INTERNED(s)) {
+		GC_DELREF(s);
+	}
 	return ret;
 }

@@ -747,6 +747,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 	HANDLE hFind = INVALID_HANDLE_VALUE;
 	ALLOCA_FLAG(use_heap_large)
 	wchar_t *pathw = NULL;
+	int may_retry_reparse_point;
 #define FREE_PATHW() \
 	do { free(pathw); } while(0);

@@ -845,6 +846,8 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}

 #ifdef ZEND_WIN32
+retry_reparse_point:
+		may_retry_reparse_point = 0;
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -867,7 +870,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry:
+retry_reparse_tag_cloud:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -928,7 +931,7 @@ retry:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry;
+					goto retry_reparse_tag_cloud;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -939,6 +942,7 @@ retry:
 			CloseHandle(hLink);

 			if(pbuffer->ReparseTag == IO_REPARSE_TAG_SYMLINK) {
+				may_retry_reparse_point = 1;
 				reparsetarget = pbuffer->SymbolicLinkReparseBuffer.ReparseTarget;
 				isabsolute = (pbuffer->SymbolicLinkReparseBuffer.Flags == 0) ? 1 : 0;
 #if VIRTUAL_CWD_DEBUG
@@ -1075,6 +1079,22 @@ retry:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);

+			if (may_retry_reparse_point) {
+				DWORD attrs;
+
+				FREE_PATHW()
+				pathw = php_win32_ioutil_any_to_w(path);
+				if (!pathw) {
+					return (size_t)-1;
+				}
+				attrs = GetFileAttributesW(pathw);
+				if (!isVolume && attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					free_alloca(tmp, use_heap);
+					FREE_PATHW()
+					goto retry_reparse_point;
+				}
+			}
+
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
@@ -4819,6 +4819,7 @@ ZEND_VM_HANDLER(164, ZEND_RECV_VARIADIC, NUM, UNUSED|CACHE_SLOT)
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) {
 			param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T);
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
+				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
 				do {
 					zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num));
 					if (Z_OPT_REFCOUNTED_P(param)) Z_ADDREF_P(param);
@@ -7096,15 +7097,6 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 	zfunc = zend_hash_find_ex(EG(function_table), Z_STR_P(RT_CONSTANT(opline, opline->op1)), 1);
 	ZEND_ASSERT(zfunc != NULL && Z_FUNC_P(zfunc)->type == ZEND_USER_FUNCTION);

-	fbc = Z_PTR_P(zfunc);
-	if (fbc->common.fn_flags & ZEND_ACC_IMMUTABLE) {
-		zend_function *new_func = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
-
-		memcpy(new_func, fbc, sizeof(zend_op_array));
-		new_func->common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
-		Z_PTR_P(zfunc) = fbc = new_func;
-	}
-
 	if (Z_TYPE(EX(This)) == IS_OBJECT) {
 		called_scope = Z_OBJCE(EX(This));
 		if (UNEXPECTED((Z_FUNC_P(zfunc)->common.fn_flags & ZEND_ACC_STATIC) ||
@@ -7371,6 +7363,7 @@ ZEND_VM_HANDLER(142, ZEND_YIELD_FROM, CONST|TMP|VAR|CV, ANY)
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		FREE_OP1();
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -2375,6 +2375,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RECV_VARIADIC_SPEC_UNUSED_HAND
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) {
 			param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T);
 			if (UNEXPECTED((EX(func)->op_array.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) != 0)) {
+				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
 				do {
 					zend_verify_arg_type(EX(func), arg_num, param, NULL, CACHE_ADDR(opline->op2.num));
 					if (Z_OPT_REFCOUNTED_P(param)) Z_ADDREF_P(param);
@@ -3707,6 +3708,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_CONST_HANDLER(
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -9207,15 +9209,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_C
 	zfunc = zend_hash_find_ex(EG(function_table), Z_STR_P(RT_CONSTANT(opline, opline->op1)), 1);
 	ZEND_ASSERT(zfunc != NULL && Z_FUNC_P(zfunc)->type == ZEND_USER_FUNCTION);

-	fbc = Z_PTR_P(zfunc);
-	if (fbc->common.fn_flags & ZEND_ACC_IMMUTABLE) {
-		zend_function *new_func = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
-
-		memcpy(new_func, fbc, sizeof(zend_op_array));
-		new_func->common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
-		Z_PTR_P(zfunc) = fbc = new_func;
-	}
-
 	if (Z_TYPE(EX(This)) == IS_OBJECT) {
 		called_scope = Z_OBJCE(EX(This));
 		if (UNEXPECTED((Z_FUNC_P(zfunc)->common.fn_flags & ZEND_ACC_STATIC) ||
@@ -18346,6 +18339,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_TMP_HANDLER(ZE
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		zval_ptr_dtor_nogc(free_op1);
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -21672,6 +21666,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_VAR_HANDLER(ZE
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+		zval_ptr_dtor_nogc(free_op1);
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -37896,6 +37891,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_YIELD_FROM_SPEC_CV_HANDLER(ZEN
 		}
 	} else {
 		zend_throw_error(NULL, "Can use \"yield from\" only with arrays and Traversables");
+
 		UNDEF_RESULT();
 		HANDLE_EXCEPTION();
 	}
@@ -329,8 +329,8 @@ dnl
 dnl PHP_CHECK_GCC_ARG(arg, action-if-found, action-if-not-found)
 dnl
 AC_DEFUN([PHP_CHECK_GCC_ARG],[
-  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z-,a-z_)
-  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z-,a-z_), [
+  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z=-,a-z__)
+  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z=-,a-z__), [
  echo 'void somefunc() { };' > conftest.c
  cmd='$CC $1 -c conftest.c'
  if eval $cmd 2>&1 | $EGREP -e $1 >/dev/null ; then
@@ -1209,14 +1209,14 @@ AC_DEFUN([PHP_DOES_PWRITE_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    main() {
+    int main() {
    int fd = open("conftest_in", O_WRONLY|O_CREAT, 0600);

-    if (fd < 0) exit(1);
-    if (pwrite(fd, "text", 4, 0) != 4) exit(1);
+    if (fd < 0) return 1;
+    if (pwrite(fd, "text", 4, 0) != 4) return 1;
    /* Linux glibc breakage until 2.2.5 */
-    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) exit(1);
-    exit(0);
+    if (pwrite(fd, "text", 4, -1) != -1 || errno != EINVAL) return 1;
+    return 0;
    }

  ]])],[
@@ -1239,14 +1239,14 @@ AC_DEFUN([PHP_DOES_PREAD_WORK],[
 #include <unistd.h>
 #include <errno.h>
 $1
-    main() {
+    int main() {
    char buf[3];
    int fd = open("conftest_in", O_RDONLY);
-    if (fd < 0) exit(1);
-    if (pread(fd, buf, 2, 0) != 2) exit(1);
+    if (fd < 0) return 1;
+    if (pread(fd, buf, 2, 0) != 2) return 1;
    /* Linux glibc breakage until 2.2.5 */
-    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) exit(1);
-    exit(0);
+    if (pread(fd, buf, 2, -1) != -1 || errno != EINVAL) return 1;
+    return 0;
    }
  ]])],[
    ac_cv_pread=yes
@@ -1347,25 +1347,26 @@ AC_DEFUN([PHP_READDIR_R_TYPE],[
 #define _REENTRANT
 #include <sys/types.h>
 #include <dirent.h>
+#include <unistd.h>

 #ifndef PATH_MAX
 #define PATH_MAX 1024
 #endif

-main() {
+int main() {
  DIR *dir;
  char entry[sizeof(struct dirent)+PATH_MAX];
  struct dirent *pentry = (struct dirent *) &entry;

  dir = opendir("/");
  if (!dir)
-    exit(1);
+    return 1;
  if (readdir_r(dir, (struct dirent *) entry, &pentry) == 0) {
    close(dir);
-    exit(0);
+    return 0;
  }
  close(dir);
-  exit(1);
+  return 1;
 }
    ]])],[
      ac_cv_what_readdir_r=POSIX
@@ -1693,6 +1694,7 @@ AC_DEFUN([PHP_BROKEN_GLIBC_FOPEN_APPEND], [
  AC_CACHE_VAL(_cv_have_broken_glibc_fopen_append,[
  AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <stdio.h>
+#include <unistd.h>
 int main(int argc, char *argv[])
 {
  FILE *fp;
@@ -1702,7 +1704,7 @@ int main(int argc, char *argv[])
  fp = fopen(filename, "w");
  if (fp == NULL) {
    perror("fopen");
-    exit(2);
+    return 2;
  }
  fputs("foobar", fp);
  fclose(fp);
@@ -1812,13 +1814,13 @@ int seeker(void *cookie, __off64_t *position, int whence)

 cookie_io_functions_t funcs = {reader, writer, seeker, closer};

-main() {
+int main() {
  struct cookiedata g = { 0 };
  FILE *fp = fopencookie(&g, "r", funcs);

  if (fp && fseek(fp, 8192, SEEK_SET) == 0 && g.pos == 8192)
-    exit(0);
-  exit(1);
+    return 0;
+  return 1;
 }

 ]])], [
@@ -2252,6 +2254,8 @@ AC_DEFUN([PHP_SETUP_ICU],[
      fi
    fi
  fi
+
+  ICU_CFLAGS="$ICU_CFLAGS -DU_DEFINE_FALSE_AND_TRUE=1"
 ])

 dnl
@@ -978,10 +978,6 @@ else
 #  endif
 #endif

-#ifdef __cplusplus
-extern "C" void exit (int);
-#endif
-
 void fnord() { int i=42;}
 int main ()
 {
@@ -997,7 +993,7 @@ int main ()
  else
    puts (dlerror ());

-    exit (status);
+    return (status);
 }]
 EOF
  if AC_TRY_EVAL(ac_link) && test -s conftest${ac_exeext} 2>/dev/null; then
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=20
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=28
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -716,6 +716,7 @@ dnl Also check for working getaddrinfo
 AC_CACHE_CHECK([for getaddrinfo], ac_cv_func_getaddrinfo,
 [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <netdb.h>]],
  [[struct addrinfo *g,h;g=&h;getaddrinfo("","",g,&g);]])],[AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <string.h>
 #include <netdb.h>
 #include <sys/types.h>
 #ifndef AF_INET
@@ -728,11 +729,11 @@ int main(void) {
  hints.ai_flags = AI_NUMERICHOST;

  if (getaddrinfo("127.0.0.1", 0, &hints, &ai) < 0) {
-    exit(1);
+    return 1;
  }

  if (ai == 0) {
-    exit(1);
+    return 1;
  }

  pai = ai;
@@ -740,16 +741,16 @@ int main(void) {
  while (pai) {
    if (pai->ai_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      exit(1);
+      return 1;
    }
    if (pai->ai_addr->sa_family != AF_INET) {
      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
-      exit(1);
+      return 1;
    }
    pai = pai->ai_next;
  }
  freeaddrinfo(ai);
-  exit(0);
+  return 0;
 }
  ]])],[ac_cv_func_getaddrinfo=yes], [ac_cv_func_getaddrinfo=no], [ac_cv_func_getaddrinfo=no])],
 [ac_cv_func_getaddrinfo=no])])
@@ -83,12 +83,12 @@ bool(false)
 resource(%d) of type (stream)
 resource(%d) of type (stream)

-Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)

-Warning: fopen(bz_open_002.txt): failed to open stream: Bad file %s in %s on line %d
+Warning: fopen(bz_open_002.txt): failed to open stream: `br' is not a valid mode for fopen in %s on line %d

 Warning: bzopen(): first parameter has to be string or file-resource in %s on line %d
 bool(false)
@@ -23,20 +23,25 @@
 #include "sdncal.h"
 #include <time.h>

+#define SECS_PER_DAY (24 * 3600)
+
 /* {{{ proto int unixtojd([int timestamp])
   Convert UNIX timestamp to Julian Day */
 PHP_FUNCTION(unixtojd)
 {
 	time_t ts = 0;
+	zend_long tl = 0;
 	struct tm *ta, tmbuf;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &ts) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &tl) == FAILURE) {
 		return;
 	}

-	if (!ts) {
+	if (!tl) {
 		ts = time(NULL);
-	} else if (ts < 0) {
+	} else if (tl >= 0) {
+		ts = (time_t) tl;
+	} else {
 		RETURN_FALSE;
 	}

@@ -59,11 +64,11 @@ PHP_FUNCTION(jdtounix)
 	}
 	uday -= 2440588 /* J.D. of 1.1.1970 */;

-	if (uday < 0 || uday > 24755) { /* before beginning of unix epoch or behind end of unix epoch */
+	if (uday < 0 || uday > ZEND_LONG_MAX / SECS_PER_DAY) { /* before beginning of unix epoch or greater than representable */
 		RETURN_FALSE;
 	}

-	RETURN_LONG(uday * 24 * 3600);
+	RETURN_LONG(uday * SECS_PER_DAY);
 }
 /* }}} */

@@ -0,0 +1,17 @@
+--TEST--
+Bug #80185 (jdtounix() fails after 2037)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 8) die("skip for 64bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(jdtounix(2465712));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
+?>
+--EXPECT--
+int(2170713600)
+int(9223372036854720000)
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #80185 (jdtounix() fails after 2037)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 4) die("skip for 32bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(jdtounix(2465712));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440588));
+var_dump(jdtounix(PHP_INT_MAX / 86400 + 2440589));
+?>
+--EXPECT--
+bool(false)
+int(2147472000)
+bool(false)
@@ -61,7 +61,7 @@ PHP_FUNCTION(com_create_instance)
 			&module_name, &module_name_len, &server_name, &server_name_len,
 			&cp, &typelib_name, &typelib_name_len) &&
 		FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET,
-			ZEND_NUM_ARGS(), "sa|ls",
+			ZEND_NUM_ARGS(), "sa/|ls",
 			&module_name, &module_name_len, &server_params, &cp,
 			&typelib_name, &typelib_name_len)) {

@@ -133,7 +133,7 @@ PHP_FUNCTION(com_create_instance)
 		info.pwszName = php_com_string_to_olestring(server_name, server_name_len, obj->code_page);

 		if (user_name) {
-			authid.User = php_com_string_to_olestring(user_name, -1, obj->code_page);
+			authid.User = (OLECHAR*)user_name;
 			authid.UserLength = (ULONG)user_name_len;

 			if (password) {
@@ -221,7 +221,6 @@ PHP_FUNCTION(com_create_instance)

 	if (server_name) {
 		if (info.pwszName) efree(info.pwszName);
-		if (authid.User) efree(authid.User);
 	}

 	efree(moniker);
@@ -248,7 +247,7 @@ PHP_FUNCTION(com_create_instance)
 		TL = php_com_load_typelib_via_cache(typelib_name, obj->code_page, &cached);

 		if (TL) {
-			if (COMG(autoreg_on) && !cached) {
+			if (COMG(autoreg_on)) {
 				php_com_import_typelib(TL, mode, obj->code_page);
 			}

@@ -440,8 +439,9 @@ HRESULT php_com_get_id_of_name(php_com_dotnet_object *obj, char *name,
 	if (obj->typeinfo) {
 		hr = ITypeInfo_GetIDsOfNames(obj->typeinfo, &olename, 1, dispid);
 		if (FAILED(hr)) {
+			HRESULT hr1 = hr;
 			hr = IDispatch_GetIDsOfNames(V_DISPATCH(&obj->v), &IID_NULL, &olename, 1, LOCALE_SYSTEM_DEFAULT, dispid);
-			if (SUCCEEDED(hr)) {
+			if (SUCCEEDED(hr) && hr1 != E_NOTIMPL) {
 				/* fall back on IDispatch direct */
 				ITypeInfo_Release(obj->typeinfo);
 				obj->typeinfo = NULL;
@@ -589,6 +589,7 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			}
 		}
 		efree(vargs);
+		if (byref_vals) efree(byref_vals);
 	}

 	return SUCCEEDED(hr) ? SUCCESS : FAILURE;
@@ -838,9 +839,7 @@ PHP_FUNCTION(com_load_typelib)
 	php_com_initialize();
 	pTL = php_com_load_typelib_via_cache(name, codepage, &cached);
 	if (pTL) {
-		if (cached) {
-			RETVAL_TRUE;
-		} else if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
+		if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
 			RETVAL_TRUE;
 		}

@@ -252,9 +252,7 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}

 		if ((pTL = php_com_load_typelib_via_cache(typelib_name, COMG(code_page), &cached)) != NULL) {
-			if (!cached) {
-				php_com_import_typelib(pTL, mode, COMG(code_page));
-			}
+			php_com_import_typelib(pTL, mode, COMG(code_page));
 			ITypeLib_Release(pTL);
 		}
 	}
@@ -103,3 +103,58 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t

 	return string;
 }
+
+BSTR php_com_string_to_bstr(zend_string *string, int codepage)
+{
+	BSTR bstr = NULL;
+	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
+	size_t mb_len = ZSTR_LEN(string);
+	int wc_len;
+
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, NULL, 0)) <= 0) {
+		goto fail;
+	}
+	if ((bstr = SysAllocStringLen(NULL, (UINT)(wc_len - 1))) == NULL) {
+		goto fail;
+	}
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, bstr, wc_len)) <= 0) {
+		goto fail;
+	}
+	return bstr;
+
+fail:
+	char *msg = php_win32_error_to_msg(GetLastError());
+	php_error_docref(NULL, E_WARNING,
+		"Could not convert string to unicode: `%s'", msg);
+	LocalFree(msg);
+	SysFreeString(bstr);
+	return SysAllocString(L"");
+}
+
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage)
+{
+	zend_string *string = NULL;
+	UINT wc_len = SysStringLen(bstr);
+	int mb_len;
+
+	mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, NULL, 0, NULL, NULL);
+	if (mb_len > 0) {
+		string = zend_string_alloc(mb_len - 1, 0);
+		mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, ZSTR_VAL(string), mb_len, NULL, NULL);
+	}
+
+	if (mb_len <= 0) {
+		char *msg = php_win32_error_to_msg(GetLastError());
+
+		php_error_docref(NULL, E_WARNING,
+			"Could not convert string from unicode: `%s'", msg);
+		LocalFree(msg);
+
+		if (string != NULL) {
+			zend_string_release(string);
+		}
+		string = ZSTR_EMPTY_ALLOC();
+	}
+
+	return string;
+}
@@ -114,6 +114,8 @@ static zval *saproxy_read_dimension(zval *object, zval *offset, int type, zval *
 			   	Z_STRLEN(proxy->indices[0]), DISPATCH_METHOD|DISPATCH_PROPERTYGET, &v,
 			   	proxy->dimensions, args, 0);

+		efree(args);
+
 		if (res == SUCCESS) {
 			php_com_zval_from_variant(rv, &v, proxy->obj->code_page);
 			VariantClear(&v);
@@ -387,7 +389,7 @@ static zend_object* saproxy_clone(zval *object)
 	memcpy(cloneproxy, proxy, sizeof(*cloneproxy));

 	Z_ADDREF_P(cloneproxy->zobj);
-	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval *), 0);
+	cloneproxy->indices = safe_emalloc(cloneproxy->dimensions, sizeof(zval), 0);
 	clone_indices(cloneproxy, proxy, proxy->dimensions);

 	return &cloneproxy->std;
@@ -437,7 +439,7 @@ int php_com_saproxy_create(zval *com_object, zval *proxy_out, zval *index)
 	}

 	Z_ADDREF_P(proxy->zobj);
-	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval *), 0);
+	proxy->indices = safe_emalloc(proxy->dimensions, sizeof(zval), 0);

 	if (rel) {
 		clone_indices(proxy, rel, rel->dimensions);
@@ -267,18 +267,20 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj

 	if (obj) {
 		if (dispname == NULL && sink) {
-			IProvideClassInfo2 *pci2;
-			IProvideClassInfo *pci;
+			if (V_VT(&obj->v) == VT_DISPATCH) {
+				IProvideClassInfo2 *pci2;
+				IProvideClassInfo *pci;

-			if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) {
-				gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid));
-				IProvideClassInfo2_Release(pci2);
-			}
-			if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) {
-				/* examine the available interfaces */
-				/* TODO: write some code here */
-				php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!");
-				IProvideClassInfo_Release(pci);
+				if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) {
+					gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid));
+					IProvideClassInfo2_Release(pci2);
+				}
+				if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) {
+					/* examine the available interfaces */
+					/* TODO: write some code here */
+					php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!");
+					IProvideClassInfo_Release(pci);
+				}
 			}
 		} else if (dispname == NULL) {
 			if (obj->typeinfo) {
@@ -295,15 +297,17 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj
 			/* get the library from the object; the rest will be dealt with later */
 			ITypeInfo_GetContainingTypeLib(obj->typeinfo, &typelib, &idx);
 		} else if (typelibname == NULL) {
-			IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo);
-			if (dispname) {
-				unsigned int idx;
-				/* get the library from the object; the rest will be dealt with later */
-				ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx);
+			if (V_VT(&obj->v) == VT_DISPATCH) {
+				IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo);
+				if (dispname) {
+					unsigned int idx;
+					/* get the library from the object; the rest will be dealt with later */
+					ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx);

-				if (typelib) {
-					ITypeInfo_Release(typeinfo);
-					typeinfo = NULL;
+					if (typelib) {
+						ITypeInfo_Release(typeinfo);
+						typeinfo = NULL;
+					}
 				}
 			}
 		}
@@ -96,7 +96,6 @@ bogus:

 PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage)
 {
-	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
 	zend_uchar ztype = IS_NULL;

@@ -164,13 +163,7 @@ PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codep

 		case IS_STRING:
 			V_VT(v) = VT_BSTR;
-			olestring = php_com_string_to_olestring(Z_STRVAL_P(z), Z_STRLEN_P(z), codepage);
-			if (CP_UTF8 == codepage) {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(wcslen(olestring) * sizeof(OLECHAR)));
-			} else {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(Z_STRLEN_P(z) * sizeof(OLECHAR)));
-			}
-			efree(olestring);
+			V_BSTR(v) = php_com_string_to_bstr(Z_STR_P(z), codepage);
 			break;

 		case IS_RESOURCE:
@@ -236,12 +229,8 @@ PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepa
 		case VT_BSTR:
 			olestring = V_BSTR(v);
 			if (olestring) {
-				size_t len;
-				char *str = php_com_olestring_to_string(olestring,
-					&len, codepage);
-				ZVAL_STRINGL(z, str, len);
-				// TODO: avoid reallocation???
-				efree(str);
+				zend_string *str = php_com_bstr_to_string(olestring, codepage);
+				ZVAL_STR(z, str);
 				olestring = NULL;
 			}
 			break;
@@ -89,6 +89,8 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		size_t *string_len, int codepage);
 PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		size_t string_len, int codepage);
+BSTR php_com_string_to_bstr(zend_string *string, int codepage);
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage);


 /* com_com.c */
@@ -0,0 +1,14 @@
+--TEST--
+Bug #62474 (com_event_sink crashes on certain arguments)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+var_dump(com_event_sink(new variant, function() {}, array()));
+var_dump(com_event_sink(new variant, new variant, 'a'));
+?>
+--EXPECT--
+bool(false)
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #63208 (BSTR to PHP string conversion not binary safe)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$string = "\u{0905}b\0cd";
+$variant = new VARIANT($string, VT_ARRAY | VT_UI1, CP_UTF8); // Array of bytes
+$converted = (string) $variant;
+var_dump(bin2hex($string));
+var_dump(bin2hex($converted));
+?>
+--EXPECT--
+string(14) "e0a48562006364"
+string(14) "e0a48562006364"
@@ -0,0 +1,27 @@
+--TEST--
+Bug #64130 (COM obj parameters passed by reference are not updated)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+if (PHP_INT_SIZE != 4) die('skip for 32bit platforms only');
+try {
+    $ie = new com('InternetExplorer.Application');
+} catch (com_exception $ex) {
+    die("skip {$ex->getMessage()}");
+}
+$ie->quit();
+?>
+--FILE--
+<?php
+$ie = new com('InternetExplorer.Application');
+$x = 0;
+$y = 0;
+try {
+    $ie->clientToWindow($x, $y);
+} catch (com_exception $ex) {}
+var_dump($x > 0, $y > 0);
+$ie->quit();
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -2719,7 +2719,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				return FAILURE;
 			}

-			ZEND_HASH_FOREACH_VAL(ph, current) {
+			ZEND_HASH_FOREACH_VAL_IND(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
 				slist = curl_slist_append(slist, ZSTR_VAL(val));
@@ -2797,7 +2797,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				}
 #endif

-				ZEND_HASH_FOREACH_KEY_VAL(postfields, num_key, string_key, current) {
+				ZEND_HASH_FOREACH_KEY_VAL_IND(postfields, num_key, string_key, current) {
 					zend_string *postval, *tmp_postval;
 					/* Pretend we have a string_key here */
 					if (!string_key) {
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79741: curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties
+--FILE--
+<?php
+
+class Test {
+	public $prop = "value";
+}
+
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_POSTFIELDS, new Test);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -7,7 +7,7 @@ TestFest 2009 - AFUP - Perrick Penet <perrick@noparking.net>
 --FILE--
 <?php

-$url = uniqid()."://www.".uniqid().".".uniqid();
+$url = substr(uniqid(),0,7)."://www.".uniqid().".".uniqid();
 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $url);

@@ -18,6 +18,6 @@ curl_close($ch);


 ?>
--EXPECTREGEX--
-string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
-int\(\d\)
+--EXPECTF--
+string(%d) "%Srotocol%s"
+int(1)
@@ -1,6 +1,7 @@
 // vim:ft=javascript

 EXTENSION("date", "php_date.c", false, "/Iext/date/lib /DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 /DHAVE_TIMELIB_CONFIG_H=1");
+PHP_DATE = "yes";
 ADD_SOURCES("ext/date/lib", "astro.c timelib.c dow.c parse_date.c parse_tz.c tm2unixtime.c unixtime2tm.c parse_iso_intervals.c interval.c", "date");
 AC_DEFINE('HAVE_DATE', 1, 'Have date/time support');

@@ -1001,7 +1001,7 @@ reltextnumber = 'first'|'second'|'third'|'fourth'|'fifth'|'sixth'|'seventh'|'eig
 reltexttext = 'next'|'last'|'previous'|'this';
 reltextunit = 'ms' | 'µs' | (('msec'|'millisecond'|'µsec'|'microsecond'|'usec'|'sec'|'second'|'min'|'minute'|'hour'|'day'|'fortnight'|'forthnight'|'month'|'year') 's'?) | 'weeks' | daytext;

-relnumber = ([+-]*[ \t]*[0-9]+);
+relnumber = ([+-]*[ \t]*[0-9]{1,13});
 relative = relnumber space? (reltextunit | 'week' );
 relativetext = (reltextnumber|reltexttext) space reltextunit;
 relativetextweek = reltexttext space 'week';
@@ -322,9 +322,9 @@ typedef struct _timelib_tzdb {
 # define timelib_free    free
 #endif

-#define TIMELIB_VERSION 201803
-#define TIMELIB_EXTENDED_VERSION 20180301
-#define TIMELIB_ASCII_VERSION "2018.03"
+#define TIMELIB_VERSION 201804
+#define TIMELIB_EXTENDED_VERSION 20180401
+#define TIMELIB_ASCII_VERSION "2018.04"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01
@@ -367,6 +367,14 @@ static timelib_sll do_years(timelib_sll year)
 	timelib_sll eras;

 	eras = (year - 1970) / 40000;
+
+	/* Hack to make sure we don't overflow. Right now, we can't easily thrown a
+	 * warning in this case, so we'll just return some rubbish. Sucks, but at
+	 * least it doesn't show UBSAN warnings anymore */
+	if (eras < -1000000 || eras > 1000000) {
+		return eras > 0 ? LLONG_MAX/10 : LLONG_MIN/10;
+	}
+
 	if (eras != 0) {
 		year = year - (eras * 40000);
 		res += (SECS_PER_ERA * eras * 100);
@@ -6,12 +6,12 @@ Handling of large year values
 <?php
 date_default_timezone_set("America/Toronto");

-$t = mktime(0,0,0,1,1,292277026596);
+$t = mktime(0,0,0,1,1,2922770265);

 var_dump(date("r", $t));

 echo "OK\n";
 ?>
--EXPECT--
-string(39) "Fri, 01 Jan 292277026596 00:00:00 -0500"
+--EXPECTF--
+string(%d) "%s, 01 Jan 2922770265 00:00:00 -0500"
 OK
@@ -4,7 +4,7 @@ Bug #48097 (date_timezone_set function produces wrong datetime result)
 date.timezone=UTC
 --FILE--
 <?php
-$d = date_create( "Mon, 23 May 1955 00:00:00 +0200" );
+$d = date_create( "Sun, 22 May 1955 02:00:00 +0200" );
 var_dump( $d );
 echo $d->format( DATE_ISO8601 ), "\n";
 echo $d->format( 'U' ), "\n\n";
@@ -16,23 +16,23 @@ echo $d->format( 'U' ), "\n\n";
 --EXPECT--
 object(DateTime)#1 (3) {
  ["date"]=>
-  string(26) "1955-05-23 00:00:00.000000"
+  string(26) "1955-05-22 02:00:00.000000"
  ["timezone_type"]=>
  int(1)
  ["timezone"]=>
  string(6) "+02:00"
 }
-1955-05-23T00:00:00+0200
-461124000
+1955-05-22T02:00:00+0200
+-461203200

 object(DateTime)#1 (3) {
  ["date"]=>
-  string(26) "1955-05-22 23:00:00.000000"
+  string(26) "1955-05-22 01:00:00.000000"
  ["timezone_type"]=>
  int(3)
  ["timezone"]=>
  string(15) "Europe/Budapest"
 }
-1955-05-22T23:00:00+0100
+1955-05-22T01:00:00+0100

-461124000
+-461203200
@@ -2024,7 +2024,6 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 		}
 		ctxt = htmlCreateFileParserCtxt(source, NULL);
 	} else {
-		source_len = xmlStrlen((xmlChar *) source);
 		if (ZEND_SIZE_T_INT_OVFL(source_len)) {
 			php_error_docref(NULL, E_WARNING, "Input string is too long");
 			RETURN_FALSE;
@@ -0,0 +1,24 @@
+--TEST--
+Bug #80268 (loadHTML() truncates at NUL bytes)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$doc = new DOMDocument;
+$doc->loadHTML("<p>foo\0bar</p>");
+$html = $doc->saveHTML();
+var_dump(strpos($html, '<p>foo</p>') !== false);
+
+file_put_contents(__DIR__ . '/80268.html', "<p>foo\0bar</p>");
+$doc = new DOMDocument;
+$doc->loadHTMLFile(__DIR__ . '/80268.html');
+$html = $doc->saveHTML();
+var_dump(strpos($html, '<p>foo</p>') !== false);
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/80268.html');
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -66,7 +66,8 @@ typedef unsigned char uchar;

 #define EFREE_IF(ptr)	if (ptr) efree(ptr)

-#define MAX_IFD_NESTING_LEVEL 150
+#define MAX_IFD_NESTING_LEVEL 10
+#define MAX_IFD_TAGS 1000

 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
@@ -1940,6 +1941,7 @@ typedef struct {
 	int             read_thumbnail;
 	int             read_all;
 	int             ifd_nesting_level;
+	int             ifd_count;
 	/* internal */
 	file_section_list 	file;
 } image_info_type;
@@ -2674,6 +2676,7 @@ static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
 /* forward declarations */
 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int tag);
 static int exif_process_IFD_TAG(    image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table);
+static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index);

 /* {{{ exif_get_markername
 	Get name of marker */
@@ -3173,6 +3176,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

+	/* It can be that motorola_intel is wrongly mapped, let's try inverting it */
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");
+
+		ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
+		NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
+	}
+
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		return FALSE;
+	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
+
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
@@ -3203,15 +3223,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			break;
 	}

-	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
-		return FALSE;
-	}
-	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-		return FALSE;
-	}
-
 	for (de=0;de<NumDirEntries;de++) {
 		size_t offset = 2 + 12 * de;
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
@@ -3238,7 +3249,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
-static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
+static int exif_process_IFD_TAG_impl(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
 {
 	size_t length;
 	unsigned int tag, format, components;
@@ -3251,13 +3262,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	int dump_free;
 #endif /* EXIF_DEBUG */

-	/* Protect against corrupt headers */
-	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
-		return FALSE;
-	}
-	ImageInfo->ifd_nesting_level++;
-
 	tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
 	format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
 	components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
@@ -3577,6 +3581,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 }
 /* }}} */

+static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
+{
+	int result;
+	/* Protect against corrupt headers */
+	if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum IFD tag count reached");
+		return FALSE;
+	}
+	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
+		return FALSE;
+	}
+	ImageInfo->ifd_nesting_level++;
+	result = exif_process_IFD_TAG_impl(ImageInfo, dir_entry, offset_base, IFDlength, displacement, section_index, ReadNextIFD, tag_table);
+	ImageInfo->ifd_nesting_level--;
+	return result;
+}
+
 /* {{{ exif_process_IFD_in_JPEG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int tag)
@@ -4010,7 +4032,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)

 /* {{{ exif_process_IFD_in_TIFF
 * Parse the TIFF header; */
-static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
+static int exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_offset, int section_index)
 {
 	int i, sn, num_entries, sub_section_index = 0;
 	unsigned char *dir_entry;
@@ -4019,10 +4041,6 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 	int entry_tag , entry_type;
 	tag_table_type tag_table = exif_get_tag_table(section_index);

-	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-		return FALSE;
-	}
-
 	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
@@ -4166,7 +4184,6 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 #ifdef EXIF_DEBUG
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s @x%04X", exif_get_sectionname(sub_section_index), entry_offset);
 #endif
-						ImageInfo->ifd_nesting_level++;
 						exif_process_IFD_in_TIFF(ImageInfo, entry_offset, sub_section_index);
 						if (section_index!=SECTION_THUMBNAIL && entry_tag==TAG_SUB_IFD) {
 							if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
@@ -4210,7 +4227,6 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) at x%04X", next_offset);
 #endif
-					ImageInfo->ifd_nesting_level++;
 					exif_process_IFD_in_TIFF(ImageInfo, next_offset, SECTION_THUMBNAIL);
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
@@ -4247,6 +4263,21 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 }
 /* }}} */

+static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
+{
+	int result;
+	if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
+		return FALSE;
+	}
+	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+		return FALSE;
+	}
+	ImageInfo->ifd_nesting_level++;
+	result = exif_process_IFD_in_TIFF_impl(ImageInfo, dir_offset, section_index);
+	ImageInfo->ifd_nesting_level--;
+	return result;
+}
+
 /* {{{ exif_scan_FILE_header
 * Parse the marker stream until SOS or EOI is seen; */
 static int exif_scan_FILE_header(image_info_type *ImageInfo)
@@ -4402,6 +4433,7 @@ static int exif_read_from_impl(image_info_type *ImageInfo, php_stream *stream, i


 	ImageInfo->ifd_nesting_level = 0;
+	ImageInfo->ifd_count = 0;

 	/* Scan the headers */
 	ret = exif_scan_FILE_header(ImageInfo);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
+$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);
+
+echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
+echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+38/1
+122/1
+===DONE===
@@ -0,0 +1,10 @@
+--TEST--
+Should not cause OOM
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/nesting_level_oom.tiff'));
+
+?>
+--EXPECT--
+bool(false)
@@ -218,6 +218,7 @@ PHP_MINIT_FUNCTION(finfo)
 	memcpy(&finfo_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
 	finfo_object_handlers.offset = XtOffsetOf(finfo_object, zo);
 	finfo_object_handlers.free_obj = finfo_objects_free;
+	finfo_object_handlers.clone_obj = NULL;

 	le_fileinfo = zend_register_list_destructors_ex(finfo_resource_destructor, NULL, "file_info", module_number);

@@ -0,0 +1,16 @@
+--TEST--
+Bug #79756 (finfo_file crash (FILEINFO_MIME))
+--SKIPIF--
+<?php
+if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug79756.xls';
+$finfo = finfo_open(FILEINFO_MIME);
+$mime = finfo_file($finfo, $filename);
+finfo_close($finfo);
+echo $mime;
+?>
+--EXPECT--
+application/vnd.ms-excel; charset=binary
@@ -0,0 +1,27 @@
+--TEST--
+Cloning and serializing finfo is not supported
+--FILE--
+<?php
+
+$finfo = new finfo;
+var_dump($finfo->buffer("Test string"));
+try {
+    $finfo2 = clone $finfo;
+    var_dump($finfo2->buffer("Test string"));
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $finfo3 = unserialize(serialize($finfo));
+    var_dump($finfo3->buffer("Test string"));
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+string(%d) "%s"
+Trying to clone an uncloneable object of class finfo
+
+Warning: finfo::buffer(): The invalid fileinfo object. in %s on line %d
+bool(false)
@@ -532,6 +532,22 @@ void php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 }
 /* }}} */

+static int is_userinfo_valid(zend_string *str)
+{
+	const char *valid = "-._~!$&'()*+,;=:";
+	const char *p = ZSTR_VAL(str);
+	while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) {
+		if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+			p++;
+		} else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
+			p += 3;
+		} else {
+			return 0;
+		}
+	}
+	return 1;
+}
+
 void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 {
 	php_url *url;
@@ -592,6 +608,13 @@ bad_url:
 		php_url_free(url);
 		RETURN_VALIDATION_FAILED
 	}
+
+	if (url->user != NULL && !is_userinfo_valid(url->user)) {
+		php_url_free(url);
+		RETURN_VALIDATION_FAILED
+
+	}
+
 	php_url_free(url);
 }
 /* }}} */
@@ -0,0 +1,15 @@
+--TEST--
+Bug #77423 (parse_url() will deliver a wrong host to user)
+--FILE--
+<?php
+$urls = array(
+    "http://php.net\@aliyun.com/aaa.do",
+    "https://example.com\uFF03@bing.com",
+);
+foreach ($urls as $url) {
+    var_dump(filter_var($url, FILTER_VALIDATE_URL));
+}
+?>
+--EXPECT--
+bool(false)
+bool(false)
@@ -1133,6 +1133,8 @@ bail:
 zend_long
 ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 {
+	zend_long res;
+
 	if (ftp == NULL) {
 		return -1;
 	}
@@ -1145,7 +1147,8 @@ ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 	if (!ftp_getresp(ftp) || ftp->resp != 213) {
 		return -1;
 	}
-	return atol(ftp->inbuf);
+	ZEND_ATOL(res, ftp->inbuf);
+	return res;
 }
 /* }}} */

@@ -1463,6 +1463,8 @@ void gdImageChar (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color)
 	int cx, cy;
 	int px, py;
 	int fline;
+	const int xuppper = (x > INT_MAX - f->w) ? INT_MAX : x + f->w;
+	const int yuppper = (y > INT_MAX - f->h) ? INT_MAX : y + f->h;
 	cx = 0;
 	cy = 0;
 #ifdef CHARSET_EBCDIC
@@ -1472,8 +1474,8 @@ void gdImageChar (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color)
 		return;
 	}
 	fline = (c - f->offset) * f->h * f->w;
-	for (py = y; (py < (y + f->h)); py++) {
-		for (px = x; (px < (x + f->w)); px++) {
+	for (py = y; py < yuppper; py++) {
+		for (px = x; px < xuppper; px++) {
 			if (f->data[fline + cy * f->w + cx]) {
 				gdImageSetPixel(im, px, py, color);
 			}
@@ -1489,6 +1491,8 @@ void gdImageCharUp (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color)
 	int cx, cy;
 	int px, py;
 	int fline;
+	const int xuppper = (x > INT_MAX - f->h) ? INT_MAX : x + f->h;
+	const int ylower = (y < INT_MIN + f->w) ? INT_MIN : y - f->w;
 	cx = 0;
 	cy = 0;
 #ifdef CHARSET_EBCDIC
@@ -1498,8 +1502,8 @@ void gdImageCharUp (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color)
 		return;
 	}
 	fline = (c - f->offset) * f->h * f->w;
-	for (py = y; py > (y - f->w); py--) {
-		for (px = x; px < (x + f->h); px++) {
+	for (py = y; py > ylower; py--) {
+		for (px = x; px < xuppper; px++) {
 			if (f->data[fline + cy * f->w + cx]) {
 				gdImageSetPixel(im, px, py, color);
 			}
@@ -1155,7 +1155,7 @@ ZEND_FUNCTION(gmp_export)
 	FETCH_GMP_ZVAL(gmpnumber, gmpnumber_arg, temp_a);

 	if (mpz_sgn(gmpnumber) == 0) {
-		RETURN_EMPTY_STRING();
+		RETVAL_EMPTY_STRING();
 	} else {
 		size_t bits_per_word = size * 8;
 		size_t count = (mpz_sizeinbase(gmpnumber, 2) + bits_per_word - 1) / bits_per_word;
@@ -1164,7 +1164,7 @@ ZEND_FUNCTION(gmp_export)
 		mpz_export(ZSTR_VAL(out_string), NULL, order, size, endian, 0, gmpnumber);
 		ZSTR_VAL(out_string)[ZSTR_LEN(out_string)] = '\0';

-		RETURN_NEW_STR(out_string);
+		RETVAL_NEW_STR(out_string);
 	}

 	FREE_GMP_TEMP(temp_a);
@@ -50,6 +50,9 @@ foreach ($export as $k => $test) {

 var_dump($passed);

+// Argument converted from int to GMP
+var_dump(bin2hex(gmp_export(0xff)));
+
 // Invalid arguments (zpp failure)
 var_dump(gmp_export());

@@ -62,6 +65,7 @@ var_dump(gmp_export(123, 1, GMP_MSW_FIRST | GMP_LSW_FIRST));
 var_dump(gmp_export(123, 1, GMP_BIG_ENDIAN | GMP_LITTLE_ENDIAN));
 --EXPECTF--
 bool(true)
+string(2) "ff"

 Warning: gmp_export() expects at least 1 parameter, 0 given in %s on line %d
 NULL
@@ -129,7 +129,7 @@ int main() {

 int main() {
  iconv_t cd;
-  cd = iconv_open( "*blahblah*", "*blahblah*" );
+  cd = iconv_open( "*blahblah*", "*blahblahblah*" );
  if (cd == (iconv_t)(-1)) {
    if (errno == EINVAL) {
      return 0;
@@ -1315,7 +1315,7 @@ PHP_FUNCTION(imap_reopen)

 	imap_le_struct->imap_stream = mail_open(imap_le_struct->imap_stream, ZSTR_VAL(mailbox), flags);
 	if (imap_le_struct->imap_stream == NIL) {
-		zend_list_delete(Z_RES_P(streamind));
+		zend_list_close(Z_RES_P(streamind));
 		php_error_docref(NULL, E_WARNING, "Couldn't re-open stream");
 		RETURN_FALSE;
 	}
@@ -2692,8 +2692,9 @@ PHP_FUNCTION(imap_rfc822_write_address)
 	if (string) {
 		RETVAL_STR(string);
 	} else {
-		RETURN_FALSE;
+		RETVAL_FALSE;
 	}
+	mail_free_address(&addr);
 }
 /* }}} */

@@ -3074,7 +3075,8 @@ static void php_imap_mutf7(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	if (out == NIL) {
 		RETURN_FALSE;
 	} else {
-		RETURN_STRING((char *)out);
+		RETVAL_STRING((char *)out);
+		fs_give((void**) &out);
 	}
 }
 /* }}} */
@@ -3180,6 +3182,9 @@ PHP_FUNCTION(imap_sort)
 	} else {
 		spg = mail_newsearchpgm();
 	}
+	if (spg == NIL) {
+		RETURN_FALSE;
+	}

 	mypgm = mail_newsortpgm();
 	mypgm->reverse = rev;
@@ -3188,6 +3193,7 @@ PHP_FUNCTION(imap_sort)

 	slst = mail_sort(imap_le_struct->imap_stream, (argc == 6 ? ZSTR_VAL(charset) : NIL), spg, mypgm, (argc >= 4 ? flags : NIL));

+	mail_free_sortpgm(&mypgm);
 	if (spg && !(flags & SE_FREE)) {
 		mail_free_searchpgm(&spg);
 	}
@@ -3527,6 +3533,23 @@ PHP_FUNCTION(imap_fetch_overview)
 }
 /* }}} */

+static zend_bool header_injection(zend_string *str, zend_bool adrlist)
+{
+	char *p = ZSTR_VAL(str);
+
+	while ((p = strpbrk(p, "\r\n")) != NULL) {
+		if (!(p[0] == '\r' && p[1] == '\n')
+		 /* adrlists do not support folding, but swallow trailing line breaks */
+		 && !((adrlist && p[1] == '\0')
+		  /* other headers support folding */
+		  || !adrlist && (p[1] == ' ' || p[1] == '\t'))) {
+			return 1;
+		}
+		p++;
+	}
+	return 0;
+}
+
 /* {{{ proto string imap_mail_compose(array envelope, array body)
   Create a MIME message based on given envelope and body sections */
 PHP_FUNCTION(imap_mail_compose)
@@ -3543,10 +3566,17 @@ PHP_FUNCTION(imap_mail_compose)
 	int toppart = 0;
 	int first;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "aa", &envelope, &body) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "a/a/", &envelope, &body) == FAILURE) {
 		return;
 	}

+#define CHECK_HEADER_INJECTION(zstr, adrlist, header) \
+	if (header_injection(zstr, adrlist)) { \
+		php_error_docref(NULL, E_WARNING, "header injection attempt in " header); \
+		RETVAL_FALSE; \
+		goto done; \
+	}
+
 #define PHP_RFC822_PARSE_ADRLIST(target, value) \
 	str_copy = estrndup(Z_STRVAL_P(value), Z_STRLEN_P(value)); \
 	rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
@@ -3555,55 +3585,68 @@ PHP_FUNCTION(imap_mail_compose)
 	env = mail_newenvelope();
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "remail", sizeof("remail") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "remail");
 		env->remail = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "return_path", sizeof("return_path") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "return_path");
 		PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "date", sizeof("date") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "date");
 		env->date = (unsigned char*)cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "from", sizeof("from") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "from");
 		PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "reply_to", sizeof("reply_to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "reply_to");
 		PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "in_reply_to", sizeof("in_reply_to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "in_reply_to");
 		env->in_reply_to = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "subject", sizeof("subject") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "subject");
 		env->subject = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "to", sizeof("to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "to");
 		PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "cc", sizeof("cc") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "cc");
 		PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "bcc", sizeof("bcc") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "bcc");
 		PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "message_id", sizeof("message_id") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "message_id");
 		env->message_id=cpystr(Z_STRVAL_P(pvalue));
 	}

 	if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "custom_headers", sizeof("custom_headers") - 1)) != NULL) {
 		if (Z_TYPE_P(pvalue) == IS_ARRAY) {
 			custom_headers_param = tmp_param = NULL;
+			SEPARATE_ARRAY(pvalue);
 			ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pvalue), env_data) {
 				custom_headers_param = mail_newbody_parameter();
 				convert_to_string_ex(env_data);
+				CHECK_HEADER_INJECTION(Z_STR_P(env_data), 0, "custom_headers");
 				custom_headers_param->value = (char *) fs_get(Z_STRLEN_P(env_data) + 1);
 				custom_headers_param->attribute = NULL;
 				memcpy(custom_headers_param->value, Z_STRVAL_P(env_data), Z_STRLEN_P(env_data) + 1);
@@ -3620,20 +3663,29 @@ PHP_FUNCTION(imap_mail_compose)

 			if (Z_TYPE_P(data) != IS_ARRAY) {
 				php_error_docref(NULL, E_WARNING, "body parameter must be a non-empty array");
-				RETURN_FALSE;
+				RETVAL_FALSE;
+				goto done;
 			}
+			SEPARATE_ARRAY(data);

 			bod = mail_newbody();
 			topbod = bod;

 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
-				bod->type = (short) zval_get_long(pvalue);
+				zend_long type = zval_get_long(pvalue);
+				if (type >= 0 && type <= TYPEMAX && body_types[type] != NULL) {
+					bod->type = (short) type;
+				}
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
-				bod->encoding = (short) zval_get_long(pvalue);
+				zend_long encoding = zval_get_long(pvalue);
+				if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
+					bod->encoding = (short) encoding;
+				}
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
 				tmp_param = mail_newbody_parameter();
 				tmp_param->value = cpystr(Z_STRVAL_P(pvalue));
 				tmp_param->attribute = cpystr("CHARSET");
@@ -3643,10 +3695,14 @@ PHP_FUNCTION(imap_mail_compose)
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
 				if(Z_TYPE_P(pvalue) == IS_ARRAY) {
 					disp_param = tmp_param = NULL;
+					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
+						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body disposition key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3657,28 +3713,36 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
 				bod->subtype = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
 				bod->id = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
 				bod->description = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
 				bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
 				if (Z_TYPE_P(pvalue) == IS_ARRAY) {
 					disp_param = tmp_param = NULL;
+					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
+						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3687,15 +3751,19 @@ PHP_FUNCTION(imap_mail_compose)
 					bod->disposition.parameter = disp_param;
 				}
 			}
-			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
-				convert_to_string_ex(pvalue);
-				bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
-				memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
-				bod->contents.text.size = Z_STRLEN_P(pvalue);
+			if (bod->type == TYPEMESSAGE && bod->subtype && !strcmp(bod->subtype, "RFC822")) {
+				bod->nested.msg = mail_newmsg();
 			} else {
-				bod->contents.text.data = fs_get(1);
-				memcpy(bod->contents.text.data, "", 1);
-				bod->contents.text.size = 0;
+				if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
+					convert_to_string_ex(pvalue);
+					bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
+					memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
+					bod->contents.text.size = Z_STRLEN_P(pvalue);
+				} else {
+					bod->contents.text.data = fs_get(1);
+					memcpy(bod->contents.text.data, "", 1);
+					bod->contents.text.size = 0;
+				}
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "lines", sizeof("lines") - 1)) != NULL) {
 				bod->size.lines = zval_get_long(pvalue);
@@ -3705,12 +3773,17 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
 				bod->md5 = cpystr(Z_STRVAL_P(pvalue));
 			}
-		} else if (Z_TYPE_P(data) == IS_ARRAY) {
-			short type = -1;
+		} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
+			short type = 0;
+			SEPARATE_ARRAY(data);
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
-				type = (short) zval_get_long(pvalue);
+				zend_long tmp_type = zval_get_long(pvalue);
+				if (tmp_type >= 0 && tmp_type <= TYPEMAX && tmp_type != TYPEMULTIPART && body_types[tmp_type] != NULL) {
+					type = (short) tmp_type;
+				}
 			}

 			if (!toppart) {
@@ -3723,16 +3796,17 @@ PHP_FUNCTION(imap_mail_compose)
 			}

 			bod = &mypart->body;
-
-			if (type != TYPEMULTIPART) {
-				bod->type = type;
-			}
+			bod->type = type;

 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
-				bod->encoding = (short) zval_get_long(pvalue);
+				zend_long encoding = zval_get_long(pvalue);
+				if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
+					bod->encoding = (short) encoding;
+				}
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
 				tmp_param = mail_newbody_parameter();
 				tmp_param->value = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(tmp_param->value, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
@@ -3743,10 +3817,14 @@ PHP_FUNCTION(imap_mail_compose)
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
 				if (Z_TYPE_P(pvalue) == IS_ARRAY) {
 					disp_param = tmp_param = NULL;
+					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
+						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
 						disp_param->value = (char *)fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3757,28 +3835,36 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
 				bod->subtype = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
 				bod->id = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
 				bod->description = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
 				bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
 				if (Z_TYPE_P(pvalue) == IS_ARRAY) {
 					disp_param = tmp_param = NULL;
+					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
+						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body disposition key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3787,15 +3873,19 @@ PHP_FUNCTION(imap_mail_compose)
 					bod->disposition.parameter = disp_param;
 				}
 			}
-			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
-				convert_to_string_ex(pvalue);
-				bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
-				memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
-				bod->contents.text.size = Z_STRLEN_P(pvalue);
+			if (bod->type == TYPEMESSAGE && bod->subtype && !strcmp(bod->subtype, "RFC822")) {
+				bod->nested.msg = mail_newmsg();
 			} else {
-				bod->contents.text.data = fs_get(1);
-				memcpy(bod->contents.text.data, "", 1);
-				bod->contents.text.size = 0;
+				if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
+					convert_to_string_ex(pvalue);
+					bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
+					memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
+					bod->contents.text.size = Z_STRLEN_P(pvalue);
+				} else {
+					bod->contents.text.data = fs_get(1);
+					memcpy(bod->contents.text.data, "", 1);
+					bod->contents.text.size = 0;
+				}
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "lines", sizeof("lines") - 1)) != NULL) {
 				bod->size.lines = zval_get_long(pvalue);
@@ -3805,6 +3895,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
 				bod->md5 = cpystr(Z_STRVAL_P(pvalue));
 			}
 		}
@@ -3812,7 +3903,8 @@ PHP_FUNCTION(imap_mail_compose)

 	if (first) {
 		php_error_docref(NULL, E_WARNING, "body parameter must be a non-empty array");
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto done;
 	}

 	if (bod && bod->type == TYPEMULTIPART && (!bod->nested.part || !bod->nested.part->next)) {
@@ -3895,7 +3987,7 @@ PHP_FUNCTION(imap_mail_compose)

 				bod=&part->body;

-				spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+				spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data ? (char *) bod->contents.text.data : "", CRLF);
 				efree(mystring);
 				mystring=tempstring;
 			} while ((part = part->next)); /* until done */
@@ -3905,7 +3997,7 @@ PHP_FUNCTION(imap_mail_compose)
 			efree(mystring);
 			mystring=tempstring;
 	} else if (bod) {
-		spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+		spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data ? (char *) bod->contents.text.data : "", CRLF);
 		efree(mystring);
 		mystring=tempstring;
 	} else {